What is two-factor authentication (2FA)?
Two-factor authentication (2FA) adds a second step to logging in, usually a short code from an app on your phone, on top of your password. If someone steals or guesses the password, they still cannot get in without the second step.
Also called: 2FA, MFA, multi-factor authentication
ON THIS PAGE
What it means
A password is something you know. The second factor is something you have, like your phone. An attacker needs both.
Codes from an authenticator app are stronger than codes sent by text message, because text messages can be redirected to another phone number.
Why it matters for vibe-coded apps
The accounts that matter most are not your users' accounts, they are yours: your host, your GitHub, your database and your domain.
- One stolen password for your hosting or GitHub can give someone your whole app.
- Reused passwords from other leaked sites are tried against your accounts automatically.
- Users with sensitive data in your app expect an extra layer.
Example
Letting users switch on an authenticator app in a Supabase project.
await supabase.auth.signInWithPassword({ email, password });const { data } = await supabase.auth.mfa.enroll({ factorType: "totp" });
// Show data.totp.qr_code, then confirm with the 6-digit code the user typesStart by turning it on for your own accounts, then offer it to users.
How to check if your app has this problem
- 1Check that 2FA is on for GitHub, your hosting, your database, your domain registrar and your email.
- 2Check whether your app offers it, especially for admin accounts.
- 3Look at which method you use. Prefer an authenticator app or a passkey over text messages.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Turn on 2FA for every account that can change or host your app.
- 2Store the backup codes somewhere safe and offline.
- 3Offer 2FA to your users, and require it for admins.
- 4Use a managed login service that supports it, rather than building it yourself.
Add optional two-factor authentication to my app using the authentication provider I already use (for example Supabase Auth MFA with a TOTP authenticator app). Add a settings page where a user can switch it on by scanning a QR code and confirming a code, and require the code at login once it is on. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for two-factor authentication (2FA) issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Password hashingStoring passwords scrambled, so even you can't read them.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- OAuthThe standard behind "Sign in with Google" and similar buttons.
- Rate limitingA cap on how many requests someone can make in a set time.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.